---
title: Example
description: RBAC in the almost-real world
---

Let's look at an example app for allowing your users to manage domains.

As part of the API, your users will be able to perform CRUD operations against domains or individual dns records.

<Steps>
<Step titleSize="h2" title="Creating permissions">
Users of our app can have the following permissions:
- `domain.delete_domain`
- `domain.dns.create_record`
- `domain.dns.read_record`
- `domain.dns.update_record`
- `domain.dns.delete_record`
- `domain.create_domain`
- `domain.read_domain`
- `domain.update_domain`

Sign into your [dashboard](https://app.unkey.com).
    - For `Roles`, navigate to the `Authorization/Roles`. Default when navigating to `Authorization`.
    - For `Permissions`, navigate to the `Authorization/Permissions`.

Create them in your `Authorization/Permissions` page. Use the button in the upper right. `+ Create new permission`

<Frame>
  <img src="/apis/features/authorization/domains-permissions.png" alt="Example permissions"/>
  </Frame>
</Step>

<Step titleSize="h2" title="Creating roles">

We define the following roles:
- `admin`: An admin can do everything.
- `dns.manager`: Can create, read, update and delete dns records but not access the domain itself.
- `read-only`: Can read domain or dns record information.

Create them in your `Authorization/Roles` page. Use the button in the upper right. `+ Create new role`

<Frame>
  <img src="/apis/features/authorization/domains-roles.png" alt="Example roles"/>
</Frame>
  
</Step>

<Step titleSize="h2" title="Connecting">
For each role, we need to connect the permissions it should have.

<Tabs>
<Tab title="admin">

<Frame>
  <img src="/apis/features/authorization/domains-roles-admin.png" alt="Admin roles"/>
  </Frame>
</Tab>

<Tab title="dns.manager">

<Frame>
  <img src="/apis/features/authorization/domains-roles-dns.manager.png" alt="dns.manager roles"/>
  </Frame>
</Tab>
<Tab title="read-only">

<Frame>
  <img src="/apis/features/authorization/domains-roles-read-only.png" alt="read-only roles"/>
  </Frame>
</Tab>
</Tabs>



</Step>
<Step title="Connect a key">
Now that we have permissions and roles in place, we can connect them to keys.

<Tabs>
<Tab title="Dashboard">

1. In the sidebar, click on one of your APIs
2. Next click on keys in the expanded API you selected.
    <Frame>
      <img src="/apis/features/authorization/api-keys-navigation.png" alt="Breadcrumb Navigation"/>
    </Frame>

3. On the key you want to use, click on the action menu (`...`) at the end of that table row.
4. Select `Manage roles and permissions..` 



<Frame>
  <img src="/apis/features/authorization/api-key-screen.png" alt="Unconnected roles and permissions"/>
  </Frame>


5. You can connect a role to your key by using the `Assign role` input. Let's give this key the `dns.manager` and `read-only` roles.

<Frame>
  <img src="/apis/features/authorization/role-add-example.png" alt="Unconnected roles and permissions"/>
  </Frame>

As you can see, the key now contains 2 `roles` and 5 `permissions` shown just above the Roles section:

</Tab>

<Tab title="API">

You can attach roles to a key when creating it by providing the role names as an array:

```bash
curl -XPOST \
  --url https://api.unkey.com/v2/keys.createKey \
  -H "Authorization: Bearer ${ROOT_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "apiId": "${API_ID}",
    "roles": [
      "role1", "role2", "role3"
    ]
  }'
```
See [here](/api-reference/v2/keys/create-api-key) for details.


</Tab>
</Tabs>
</Step>

<Step title="Verifying Permissions">

Now you can verify this key and perform permission checks. [Read more](/apis/features/authorization/verifying)

</Step>

</Steps>
